Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.
Published: 2026-07-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation (CWE‑79) in the Spacetime Ad Inserter plugin for WordPress. It allows malicious JavaScript to be injected into pages generated by the plugin, potentially exposing site visitors to client‑side attacks.

Affected Systems

The Spacetime Ad Inserter plugin for WordPress is affected. All versions up to and including 2.8.11 are vulnerable. WordPress sites running these plugin versions are at risk until the vulnerability is addressed.

Risk and Exploitability

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers could potentially target the plugin through its administrative interface or ad code insertion pages, but such details are not explicitly provided by the CVE data. Exploitation may depend on improperly configured access controls and the privileges of the user submitting data.

Generated by OpenCVE AI on August 1, 2026 at 10:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Ad Inserter plugin to a version newer than 2.8.11 that includes the XSS fix.
  • Disable or remove the plugin entirely if an upgrade is not immediately possible.
  • Reconfigure the plugin’s access control settings to ensure that only authorized administrators can modify ad content or submit code.
  • Review and sanitize any custom ad or shortcode code in use to prevent injection of malicious scripts.

Generated by OpenCVE AI on August 1, 2026 at 10:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Spacetime
Spacetime ad Inserter
Wordpress
Wordpress wordpress
Vendors & Products Spacetime
Spacetime ad Inserter
Wordpress
Wordpress wordpress

Mon, 13 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.
Title WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Spacetime Ad Inserter
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-13T16:07:51.470Z

Reserved: 2026-06-25T08:03:50.157Z

Link: CVE-2026-57693

cve-icon Vulnrichment

Updated: 2026-07-13T16:02:13.998Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T10:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')